On this page

A new circle: circle in a box DRAFT 0.3.0

Plain-words text · Technical specification · All documents

English text rendered from the project's source documents. The Slovene original is on lananostr.site. Where this text and the definitions differ, the definitions win.

Precedence: where this document and definitions 0.3.0 differ, the definitions (docs/bsa-records-0.3.0.json) win; the difference is a mistake in this document, to be fixed.

Foundation. Transparent, decentralised infrastructure is the basis of our development, and nothing is ever hidden. All transactions are public and stored on the relays, so the ledger can be restored from them at any moment. Applications only read from the relays, check and show. The six development principles: docs/nacela-razvoja.md.

Status. The first part of the box works already: a copy of the app with one settings file, its own ledger and its own keys. The owner's answers to questions 1–9, to the open points (in the afternoon of the same day), to points C1–C7 (17 October), to the three questions after phase D (1A, 2A and 3A, the evening of 17 October) and before phase E (E-1 to E-9, 23 October) are written in below under "Decided". What changed on 23 October carries the label [Decided 23 Oct 2026, E-n], [Proposal] or [Consequence] (follows from a decision). What is still marked as a proposal or as open waits for the owner's yes. None of the new parts is built yet. Nothing has been published to the relays yet.

The essence#

Every circle has its own app (decided 16 October). A new circle is a copy of the LetsBalance app on its own server, with its own keys and its own address. There is no master app for several circles.
The box is a cell. It holds everything the circle needs to work on its own. The circle keeps its public ledger on its own relays, one of them in its own box (decided, question 2).
One code for every circle. Nothing in the code belongs to one circle only. What differs between circles goes into one settings file.
Four settings: a short circle code, the circle's name, one currency (EURB, USDB or GBPB; EUR, USD or GBP in the setting) and the page address. The fifth is the creator's BSA ID, which today becomes the circle's administrator; under definitions 0.3.0 the founder seats the first Circle Heart in the found act [Proposal].
The Circle Heart (decided, question 4 and point 4a; the name: decided 23 Oct 2026, E-2). In the live circle the Heart is four: the founder and three other Heart members. A project needs at least three Heart votes for and no vote against [Decided 23 Oct 2026, E-1 and E-5]. The circle's members do not elect the Heart; the Heart itself adds and removes Heart members [Decided 23 Oct 2026, E-2].
Whoever creates the circle founds it (decided 16 October). Today the creator becomes the administrator on first signing in with that BSA ID. Only a member of an existing circle [Decided 23 Oct 2026, E-8]: a new circle can be founded only by someone who is a member of some circle; every circle grows from the first one. Each key founds one circle only, for ever, and a person is a member of one circle at a time; so the founder leaves the old circle with a reference [Consequence of E-8 and E-9]. The circle id (decided 17 October 2026, C5): the founder signs the circle's found act (its founding charter). The fingerprint of that act (its event id) is the circle id, the circle's name for ever. It is not a key, so nobody can steal it; another found act is another circle. Proposal: the founder signs it in their own browser, and it is written into the first block of the circle's ledger. The circle id together with the fingerprint (digest) of that block, the genesis digest, is the circle's real anchor (decided 17 October 2026, C5 and C6): by them anyone can tell the real circle from a fake.
Community money always goes to projects (decided, question 8). Projects and the reserve have no key. More below, under "Projects and the reserve".
No deposits, no payouts and no bank data (decided, question 6 and point 6a). A wave grows only from what the member receives. A new circle has no money custodian and no main account for money paid in. Money that comes into the circle stays in the circle. A new circle gets its first money from one start: at founding its reserve gets 1,000 in the circle's currency from the keyless account »izvor« ("origin") (decided 6c, below).
The circle's accounts have no key (decided, question 8 and point 8i): the reserve, the project wallets, the world account and the step-outward account. Nobody can pay from them on their own.
A circle depends on no single server and on no other circle (principle 5). It chooses and replaces its relays and its rate source itself. Its witnesses will be chosen by lot among the circles' computers; until there are enough circles to draw from, a circle has one witness, its own computer [Decided 23 Oct 2026, E-7]. If its server disappears, the ledger is restored from the relays on any other computer. Said plainly: with the witness draw and the reference (a new circle reads the old circle's ledger) a circle depends on the network of circles, not on any one circle [Consequence of E-7 and E-9; a tension with principle 5].
The time values and limits are circle settings [Decided 23 Oct 2026, E-1 and E-6]: the periods (72 hours, 90 days, 30 days, 7 days, 10 minutes), the validity of an act, the daily refusal limit, the number of Heart votes a project needs (at least 3) and joining (open, invite only, at most so many members with a waiting list) are written in the found act as default settings; the Circle Heart changes them within the bounds of the definitions. There is no world rules record any more. A new circle is founded open (invite_only 0): an invitation is a member's act and a new circle has no member yet; the Heart turns "invite only" on once the first members are in [Clarification, review of round 5, 23 Oct 2026].

How to set up a new circle (today)#

Copy the LetsBalance app to your own server.
Copy the settings example into your own file and fill in the code, name, currency, page address and your BSA ID.
Run one command. The app builds, checks itself with its own tests and starts.
Put a web server in front of the app for a secure connection (https).
Sign in first, with the same BSA WIF you use in the LetsBalance app. This makes you the circle's administrator today.
Keep regular copies of the circle's data with the one command in the guide. Until publishing to the relays is switched on, this copy is the ledger's only backup. It also holds the keys, so keep it as carefully as a key. Once the ledger is on the relays, the ledger and the seals restore from the relays; a database copy will only make a restart faster.

How a new circle will be founded (definitions 0.3.0)#

Decided 23 Oct 2026, E-8 and E-9; the exact shape is a proposal. Once the ledger is on the relays, founding goes like this:

The founder is a member of an existing circle (the parent circle) [Decided 23 Oct 2026, E-8]. Whoever is a member of no circle first joins some circle [Consequence of E-8].
In the parent circle they say "I want to leave". A person is a member of one circle at a time, so they leave the old one [Decided 23 Oct 2026, E-8]. The reference is issued by itself once they have settled: no minus, and no open OWN process together with a minus [Decided 23 Oct 2026, E-9]; an open OWN process without a debt stops it too [Decided 23 Oct 2026, E-9 (a)]. Whoever is in minus must settle first, or someone else settles the debt; without a reference they cannot found a circle [Consequence of E-9].
They set up the box, as today (above).
In the browser they sign the found act: name, code, currency, time zone, morning hour, time-zone database version, the first circle key (made in the browser), the first witness (the computer in the box), the first Circle Heart, relays, rate source, all circle settings, the start, the parent circle and their reference from it, and the definitions version [Decided 23 Oct 2026, E-1 and E-8; the shape: Proposal]. The fingerprint of the found act is the circle id.
The first block books the found act and the start of 1,000 for the reserve (decided 6c).
The founder joins their new circle with the same reference [Proposal]. So in the new circle they get the same step they built in the parent circle: the new circle sends the same amount to the parent circle's community, which closes their old account and returns the amount to its own »izvor« ("origin") [Consequence of E-9 (b)]. This is how the definitions write it [the shape: Proposal; §3.11 of docs/knjiga-na-relejih.md ("Membership, exclusion, the reference and closing accounts")]. Safety [Proposal]: this wave counts against the new circle's step outward, which is 0 at founding; until the wave fits under the step, the join waits (a question for the owner below).
The directory: the root relays accept the circle if the founder has a registered Lana wallet and has founded no circle before; they do not accept a second circle of the same founder [Decided 23 Oct 2026, E-8: one circle per key; how: Proposal]. Said plainly: one person with two keys can get around this; only Lana's person check could prevent it [Decided 23 Oct 2026, E-8].
The live circle is the first circle and the root of every circle; it has no parent [Proposal: the shape]. This is a tension with principles 3 and 5 (every new circle is born inside the chain of circles), for the project owner to decide [Consequence of E-8].

What is locked#

The currency is locked at the first start. A circle in euros stays a circle in euros.
The circle code is locked at the first start, because payments are signed for it. Today (the 0.2.0 circle record) it names the circle on the relays; in definitions 0.3.0 the code is only a readable label and the circle's name is its circle id (below).
The page and the server must speak of the same circle. If the page was built with other settings than the server has, the server does not start and never opens the ledger. So it can never happen that a member sees one currency on the page while the ledger books another, and a wrong start locks nothing.
The page address is required. A new circle without its own address does not start; it never points at the live circle.
The found act (decided 17 October 2026, C5 and C7; 23 October 2026, E-1 and E-8; the exact shape is a proposal): the currency, the code, the time zone, the morning hour, the version of the time-zone database (tzdata), the first circle key, the first Circle Heart, all circle settings (wave, gravity, periods and limits, joining) and the parent circle with the founder's reference are written in the found act in the first block. Only the Circle Heart changes the circle settings, with public notice [Decided 23 Oct 2026, E-1]. The currency and the code never change. The code is only a readable label of the circle; the circle's name for ever is its circle id (C5). In version 0.3.0 the time zone, the morning hour and the tzdata version do not change either (C7); a later definitions version may say how a circle follows new clock-change rules. The periods (72 hours, 90 days, 7 days, 10 minutes) and the number of Heart votes a project needs are circle settings with defaults, no longer world rules; the same for every circle is only that a project needs at least three Heart votes for and none against, and the money and gravity computation [Decided 23 Oct 2026, E-1; replaces C1].

What a new circle has from day one (today)#

an empty ledger, its own data folder and its own keys;
everything the live circle has today: payments, the wave, gravity, Common Good and support. Under the owner's decisions (6 and 6a) deposits and payouts were removed from the program on 17 October 2026 (step D0). Common Good and support become projects with a reserve (8). The program does not do this yet;
a daily seal every morning. Today it stays on the circle's server and goes nowhere. After the owner's yes on the definitions it goes to the circle's relays, together with the whole history from the start.

The box has its own relay (decided, question 2)#

A relay is like a public library that keeps a copy of the ledger. Every circle has one library at home, in the box, and copies with other owners. One library can burn down; the ledger survives.

From the first day every circle has its own relay in the box. The relay has write rules built in: it accepts the ledger's blocks only from the circle's witnesses and acts only from members and people joining; it accepts no deletion; it does not refuse old records; it never removes anything (question 19).
Until the project owner says yes, this relay is closed and reachable only from the circle's server.
The circle has at least four relays of at least three owners: its own, its witnesses' relays, a cooperative or hosting provider, and the Lana relays while the circle is small. The list is written in the circle's ledger; only a public decision changes it.
Proposal (question 14): decision 2 says at least four relays with at least three owners. Proposal: while a circle is borrowed, three relays of at least two owners are enough (the box relay and the Lana relays); this is a temporary departure from decision 2, so it is for the project owner to approve; at least three owners at the latest when the circle gets four witnesses. The four Lana relays list four different contacts, but the letter goes to one owner and one key reaches all four servers; so we count them as one owner until the project owner says otherwise.
The Lana relays count as a copy only once their owner applies the same write rules (a new letter to the owner, question 18). Until then only relays with these rules count, and the app says honestly how many copies exist. What this means for the first circles is open (the tension under question 14 below).
On the borrowed Lana relays every circle has limited space (decided, question 9). Proposal: 1 GB or one year, whichever comes first.
The node sends every block to every relay of the circle. Every day it checks that every relay has everything, fills in what is missing, and the app shows "copies 4 of 4".
How much space (estimate): a circle of 1,000 members paying twice a day needs about 5 GB a year per copy, at ten payments a day about 22 GB. The four Lana relays could carry the whole ledger of such a circle for only about two years, because the smallest of them is nearly full.
Proposal (question 15): every circle pays for its relays itself. Under decision 8 this is a project of the circle, no longer an order from Common Good. Partner circles keep each other's copies in return.
The root relays (the Lana relays on the list in record 38888) stay the directory for ever: that is where a circle is found. For small circles they are also a borrowed home with limited space. The rule "only relays from 38888" (14 September) applies to the root relays, not to circles' ledgers. The owner said yes to this reading on 16 October. A circle's ledger lives on the circle's relays.

The circle's witnesses (decided, question 3)#

A witness is like a witness at the signing of a contract: it looks whether everything is right, and signs. A witness of the circle is a computer that recomputes every block of the ledger by itself and signs it only if everything matches.

One of the witnesses is the node: it collects payments, puts them into blocks and proposes the blocks. The other witnesses do not take its word for anything; they check every number themselves.
A payment counts when a majority of witnesses (3 of 4) has confirmed its block and at least three relays hold it (decided, question 1). The member sees "paid · public on N of M relays", for example "3 of 4", in about half a second to a second and a half (an estimate; the speed of writing to the relays has not been measured yet).
Proposal (question 17): sending to the other relays goes on, and the payment does not wait for them. This changes the rule of 14 September that publishing waits for every relay. The app always shows the real "N of M".
The witnesses are chosen by lot [Decided 23 Oct 2026, E-7; replaces "the circle chooses and replaces its witnesses itself" of decision 3]: witnesses are the circles' computers, chosen by lot among the circles' computers. The direction for phase I (no code yet): a public random number, for example a block of the Lana chain; the schedule changes regularly and is known in advance; a new witness loads the circle from the latest seal; open: fake circles, matching the load, absent witnesses. Until there are enough circles to draw from, a circle has one witness, its own computer, labelled in public. The Heart's vote is only for exceptions, for example to remove a witness that misbehaves until the next draw: at least three Heart members for (the larger of k and 3) and no Heart member against, with notice (72 hours by default; a circle setting, E-1).
At most one witness per owner (decided). Two witnesses with one owner are already too many: that owner, together with two different honest witnesses, could sign two different blocks with the same number.
Every witness runs its own relay with the circle's whole history and states publicly every day that the ledger matches for it. Proposal (question 23): each witness's daily summary of its votes is public, and a single vote is given as proof whenever someone asks.
Proposal (Open 3a): when a circle grows beyond about 10,000 members, it has seven witnesses, five of whom must sign. Whether one owner may then hold two is for the project owner to decide; until then at most one.
If one witness of four fails, the circle keeps working. If two fail, payments wait, reading works and nothing is lost; the Heart replaces the witnesses by the rule for exceptions (at least three for, no Heart member against) [Decided 23 Oct 2026, E-7 and E-10].
Witnesses do not make a circle depend on any one other circle. "Independent" means "can replace any particular partner", not "needs nobody"; the owner confirmed this meaning with the owner's yes to question 3. With the draw a circle no longer chooses its witnesses itself: it gets them from the network of circles and is itself a witness for others; the Heart removes a witness that misbehaves until the next draw [Decided 23 Oct 2026, E-7]. Said plainly: this is a tension with principle 5 that phase I must resolve [Consequence].

Day one: one witness, labelled in public (decided, question 3)#

A new circle, and the live circle too, starts with one witness: its own node.
The app says publicly "single witness, not yet decentralised".
There is no money cap. That is the owner's decision: "no money cap".
Every morning the restore check (below) tests the ledger; anyone can also recompute it.
There are no deposits and no payouts (decisions 6 and 6a), so there is no switch to stop them. An error in the ledger is caught by the public label, the daily independent check and the restore check.
Once there are four witnesses with different owners, the label disappears.

The daily restore check#

Like a fire drill: every morning we check that the circle really would rise from the relays, not only when the house is on fire.

Every morning after the seal, the node restores the circle from the relays alone into an empty trial database and compares the result with the seal. The result is a public statement on the relays (after the owner's yes on the definitions). This follows from the owner's principles and needs no new decision.
A failed drill is visible to every member in the app, not only to the Circle Heart: "restore check failed on …".
How a circle rises if its server disappears:
1. Find the circle by its link or QR code (the circle id, relay addresses and the genesis digest, the fingerprint of the first block) or in the directory on the Lana relays.
2. Read the latest daily seal and the snapshot, then every block since.
3. Check everything: signatures, order, every balance. If a block is missing everywhere, the restore stops and names its number; nothing is guessed.
4. The Circle Heart (k Heart members) and the witnesses choose a new node by public decision, and it carries on.
How long it takes (estimate): a few seconds at 1,000 members, a few minutes at 100,000.
On a phone only the BSA WIF must be kept; everything else is read from the relays.

Projects and the reserve (decided, question 8 and the afternoon answers)#

Community money always goes to projects. A project is a publicly described purpose with an amount, for example work that serves everyone. In the owner's words: "So it is always projects that are funded."

Every project has its own project wallet. The circle has one more wallet, the reserve. None of them has a key. Nobody can pay from them on their own. Money moves only by a public rule that the witnesses check.
The reserve exists from the ledger's first block. A project wallet comes into being when the project is published.
Publication and the vote (decided 23 Oct 2026, E-5; replaces the objection of 8c). Any member publishes a project and at publication sets how long the vote runs: at least 72 hours (the default; a circle setting); the duration never changes afterwards. All members vote, for or against; an "against" carries a short public reason; the newest vote counts and can be changed until the end. There is no separate act "I reject", but a single "against" of any member at the end makes the project fall.
Passed or fallen (decided 23 Oct 2026, E-5 and E-1). A project passes only if at the end of the vote no member is against and at least three Heart members are for; the proposer and the recipient do not count among those three (nobody decides on their own project, decided on 10 October and 4a). Otherwise it falls and may be proposed again, changed. A project that passed starts receiving once the recipient has consented (proposal, as today).
In order (decided, 8b). The inflow goes to the projects in the order in which they started receiving: the oldest first until it is full, then the next. For now there is no limit on a project's amount and no other limit.
A project that receives, receives up to its amount. Gravity and new steps flow into it. A new step is the counter-booking made when someone's wave grows; it used to go to Common Good.
Paid in full (decided, 8a). When a project has collected its whole amount, it pays the whole amount to the doer.
Surplus goes to the reserve. When a new project passes, the reserve moves on to it by itself, up to its amount. When no project is receiving, the money stays in the reserve (follows from decision 8).
The ledger's sum stays 0. The counter-booking now goes to the reserve and, in the same entry, from it to the receiving project, no longer to the community's account. So the reserve is empty while any project can still receive.
Paying a project does not use up the community's money (decided, 8f). When a project pays a doer who is below the wave cap, their wave grows by the whole amount, and the same amount goes on at once, to the next project or to the reserve. The brake on projects is the vote (three Heart votes for and nobody against), not money.
Closing (decided, 8e). The Circle Heart can close a project with public notice (72 hours by default; a circle setting, E-1), for example when the doer steps back, leaves the circle or loses their key, or when the project turns out to be bad. The project's money goes to the reserve and from there to the next project.
After 90 days (decided, 8e). A project that does not fill within 90 days (the default; a circle setting, E-1) ends by itself. Its money goes to the reserve and from there to the next project.
Raising the step outward is a project like any other (decided, 8j). It is decided by the vote like any project (E-5); it fills from gravity and new steps. When it is full, the circle's step rises by that amount. Proposal: the recipient of such a project is the step-outward account. Since that account has no wave, such a project really uses up community money.
The single Common Good wallet, from which an order used to be paid, goes. So does the fund key.
In a new circle: until the Circle Heart has at least three members, no project can pass. So until then everything goes to the reserve. A new circle gets its first money from one start: at founding its reserve gets 1,000 in the circle's currency from the keyless account »izvor« ("origin") (decided 6c, below).
The periods are circle settings (decided 23 October 2026, E-1; replaces C1): the 72 hours, the 90 days and the 30 days are defaults that the Circle Heart changes within the bounds of the definitions. The same for every circle is only this: a project needs at least three Heart votes for and none against.
Not decided yet: contributions to a project (Open 8g) and the doer of a project (Open 8h). The proposals are below.

The rate: a quote from the seller's circle (decided, question 7)#

Every circle has one currency. When a member of one circle pays into a circle with another currency, they need a rate.

The seller's circle proposes the rate, that is, the circle of whoever receives the money. The circle chooses the rate source itself: an outside service, or one day a record on the relays.
The node in the box reads its source and makes a rate quote from it: the source, the rate, the time and how long it is valid, for example 10 minutes. The quote is a public record signed by the circle's node.
The buyer decides alone. The app shows them the converted price. If it is fine for them, they sign the payment with both amounts and a reference to the quote. If not, they do not pay. In the owner's words: "the seller's circle proposes the exchange rate and the buyer accepts it".
Both circles' ledgers carry both amounts and the reference to the quote. A circle also keeps the quotes it used on its own relays, so it restores without others.
There is no deduction and no threshold on exchange (decided earlier). No quote is ever overwritten.
The owner's rate key is no longer needed. One day it can be one of the sources a circle chooses.
To start with (decided in the afternoon): the source is the daily reference rate of the European Central Bank (public and free; euro, dollar, pound). The node reads it once a day; a quote is valid for 10 minutes (the default; a circle setting, E-1). The bank itself says these rates are for information only, so the app always shows the rate's date. Proposal: the circle can change the source at any time by an act of k Heart members (three of four in the live circle).

Keys in the box#

Today the circle's server holds three keys: the circle key, the node key and the Common Good fund key.
The circle key is held by the app and by the creator (decided 16 October). Proposal P2 (stays): that is the app in the creator's browser and a paper copy; the server holds only the node key. Under this proposal the first circle key is made in the creator's browser. That the found act names it is decided (17 October 2026, C5).
The ledger is signed by the witnesses (decided, question 3), and community money sits in wallets without a key (decided, question 8). So the circle key cannot book anything. Proposal (part of P2): the circle key is only the stamp on the mirror, that is, on the circle record in the directory on the relays, which must equal the state in the ledger; once, it also signs the found act in the first block. The circle's name is not the key but the circle id (decided 17 October 2026, C5).
The circle key can be replaced (decided 17 October 2026, C5). A stolen or lost key is replaced by the Circle Heart: k Heart members (three of four in the live circle) sign the circle key change, with public notice, 72 hours by default (a circle setting; decided 23 October 2026, E-1). Then the witnesses book it; the new key is in office from the next block (proposal). A record the old key signs for the state at or after the change never counts. The circle id does not change. Proposal: at the change the new key signs for itself and so proves that it is really held (proof of possession); so nobody can name a key someone else holds. It signs the circle id, itself and the time of the proposal, so this signature can never be used again later.
If the key is stolen or lost: a thief cannot make a false circle under the same name, because his found act would have another circle id. A lost key does not stop the mirror for good: the Heart replaces it; until the change (at least as long as the notice, 72 hours by default) there is no new mirror. Said openly: anyone can publish a circle record that names a circle id; only the one signed by the circle key that the ledger names at the block the record refers to (at the block of a key change already the new key), and equal to the state in the ledger, counts. The first-seen rule ("the first ledger stands": the root relays remember the first genesis digest and founder for every circle id) goes into the letter to the Lana relay owner and is now only extra safety (decided 17 October 2026, C6). Proposal: the root relays keep every circle's found act, and they remember a circle's first record only when they hold its found act and the same founder signed it (or, for a circle configured on the relay, when its configured circle key signed the record), so nobody can be the first to claim someone else's circle id. A relay accepts a replaced key only in its old role (an old circle key only for an old circle record).
Proposal: the circle key is never the founder's, a witness's or a Heart member's key.
There is no fund key any more (decided, question 8): projects and the reserve have no key. The world account and the step-outward account have no key either (decided, 8i). A new circle has no main account for money paid in, because there are no deposits (decided, 6a).
The node key also signs rate quotes (decided, question 7).
A witness's key stays with the witness and never goes to a relay. If it is lost, the Circle Heart (at least three Heart members for, none against; E-7, E-10) and the witnesses replace it with a new one by public decision.
Private keys never go anywhere.

Independence: what a circle needs from others#

No single server: the ledger is on at least four relays of at least three owners (decided, question 2) and restores from them.
No single circle: the circle chooses and replaces its relays and its rate source itself; its witnesses will be drawn by lot among the circles' computers (E-7), so it depends on no single circle, but on the network of circles. What it uses from others (another circle's block for a purchase outside, a rate quote, the block with a reference of a member from another circle), it also keeps on its own relays, so it restores without them [the reference: Consequence of the existing rule].
When another circle does not answer (decided, 8j): if the receiver's circle neither books nor refuses a payment, after 7 days (the default; a circle setting) the payer's circle looks into its public ledger on the relays itself. If the payment is not there and that circle's seals cover the whole time up to the note's deadline (a signed payment note can be booked for at most 10 minutes by default), the held amount goes back to the payer. If it is there, the payment stands. If the ledger cannot be read, the circle waits and never guesses. Nobody pays a refund. Proposal: in this check only a block signed by a majority of the other circle's witnesses counts; a block that no majority of the witnesses in office at the time signed (for example one signed only with an old or stolen key) is ignored, so it cannot stop the return. A key that was itself that majority at the time (for example the only witness of a one-witness circle, whose key was later stolen) can still sign a second block with the same number; then the evidence is not used and the amount stays held. A change of key or witnesses in the other circle does not stop the check. Details in the document "Currencies and exchange rates".
The directory only for finding: the circle's link and QR code carry its circle id, at least two relay addresses and its genesis digest (the fingerprint of the first block) as an extra pin. Proposal (question 10): record 38888 stays the starting directory, as the project owner decided, but no circle depends on it to work. This changes the role of the owner's 38888 decision: the root relay list stays, but a circle does not depend on it.
Its own definitions version: the circle writes in its ledger which version of the definitions it runs, so nobody can swap its definitions while it runs (proposal, question 20).
Circle settings instead of world rules (decided 23 October 2026, E-1; replaces C1 and 1A): the periods and limits are each circle's settings, with defaults in the definitions; the Circle Heart changes them within the bounds of the definitions, with public notice. There is no world rules record (KIND 43920) and no signer of it any more; the number 43920 stays reserved. Since every block carries in its state the settings in force for it, a restore from the relays always gives the same result. Across circles each circle applies its own values to its own side; a mismatch can only end in a refusal and a return to the payer, and the sum of both circles stays zero [Proposal]. Said plainly: this removes the only key that reached every circle (1A); the tension with principle 3 from 1A is removed, while inside a circle the power now lies with the Circle Heart.
Moving only with a reference (decided 23 October 2026, E-9): whoever comes into a circle from another circle comes only with the reference of their last circle. The new circle checks it in the old circle's public ledger, as for a payment that hangs (8j). It needs nobody's permission, but it needs the other circle's public ledger; if that cannot be read, the person waits [Consequence of E-9; a tension with principle 5].
Not too big: one circle must fit on one relay. Proposal (question 13): at most 100,000 members for now; a bigger community splits into several circles.
Who enters the directory (decided, question 9, "for now"; 23 October 2026, E-8): no personal approval. The circle's ledger is public from its first block on its own relays. A circle enters the directory on the Lana relays by a rule the relay checks itself: the founder has a registered Lana wallet, the found act names a parent circle (except the first circle), and the founder has founded no circle before, since each key founds one circle only, for ever [Decided 23 Oct 2026, E-8; how the relay checks it: Proposal]. This replaces "at most three circles per founder". The list of registered Lana wallets is kept by the Lana registrar, one body. A circle not listed keeps working through its link and QR code; listing decides only whether it can be found in the directory. Proposal P3 (the project owner confirms the first circles, seals go to the relays only from five members) is dropped.

Not built yet#

The found act and the first block, the box relay, the witnesses and the witness draw, the Circle Heart, the vote, joining, exclusion, the reference, closing old accounts, the circle settings in the ledger, the restore check from the relays, keyless projects and reserve, rate quotes, the circle key in the browser and its replacement. There will be no world rules record (E-1).
Deposits (with a money custodian and the main account) and payouts are no longer on this list: step D0 removed them from the program on 17 October 2026 (decisions 6 and 6a).
A first start with a settings page; for now the settings are written into a file.
Publishing to the relays: it stays off until the definitions are published and you say yes.
Time zone: gravity runs at 4 a.m. Ljubljana time in every circle; a circle in America cannot set its own yet. Decided 17 October 2026 (C7): the time zone, the morning hour and the tzdata version are written in the found act and do not change in 0.3.0. Decided 17 October 2026, evening (2A): a witness computes the morning hour with that tzdata version, not with its own newest one. Proposal: a witness that does not have that version signs no morning block and no seal.
The page's short description for search engines still speaks of euros; a circle can change it in its copy.

Decided#

The owner's answers to questions 1–9 (the project owner, 16 October 2026) and to the open points (in the afternoon of the same day; the owner confirmed point 8j with "ok" after I explained it):

When a payment counts: when a majority of witnesses (3 of 4) has confirmed its block and at least three relays hold it. The app shows "paid · public on N of M relays". The owner's answer: "yes".
Where the ledger lives: from the first day every circle has its own relay in the box, and at least four relays of at least three owners in all. The Lana relays from 38888 stay the root directory for ever and a borrowed home with limited space for small circles. The rule "relays only from 38888" applies to the root relays, not to circles' ledgers. Replaces the former proposal P4. The owner's answer: "yes".
Witnesses: one witness at the start with the public label "not yet decentralised"; then four witnesses with four different owners, three of whom must agree. The circle chooses and replaces its witnesses itself; at most one witness per owner. "Independent" means "can replace any particular partner". The owner's answer: "yes, as the assistant proposes, no money cap". The public label, the daily independent check and the public restore check stay. The part "the circle chooses and replaces its witnesses itself" was changed by E-7 on 23 October 2026 (the draw; the Heart's vote only for exceptions).
In the live circle four decide (since 23 October 2026 they are called the Circle Heart, E-2): the founder and three other Heart members. A project is approved by three of the four (since 23 October 2026: at least three Heart votes for and none against, E-5). In the owner's words: "the first people of the first circle (all of them)" and in the afternoon (4a): "I am then add a fourth person too". Their BSA IDs are written into the ledger when that step comes, not now.
The ledger knows people only by their key (BSA ID). The name is only in the Lana profile and in the member home. A person can change both at any time; a relay keeps only the newest version. The ledger never copies a name. In the owner's words: "A person can change their name, and then nobody knows any more what belonged to whom." At every free-text field (payment purpose, the reason of an "against", project title and description) the app warns: "public for ever; do not write names, personal or bank data". A legal review as a condition and text "beside the chain" are dropped. To be honest: a name can remain in old copies of a profile that someone saved, and in free text that someone writes. The ledger itself does not carry it.
There is no bank data, there are no payouts and there are no money deposits in BSA. In the owner's words: "funds are never paid out"; bank matters belong to Lana, not to BSA. In the afternoon (6a): "Forget deposits in money, that is a completely different system". Payouts and deposits go from the program. Dropped with them: the money custodian, the main account for money paid in, deposit corrections (6b), the limit for confirming a deposit (question 12) and the alarm that would have stopped deposits. A wave grows only from what is received.
The seller's circle proposes the rate from a source it chooses itself; the buyer accepts it by signing the payment with both amounts. The rate quote is a public signed record of the seller's circle. This replaces the decision that the owner's key signs the rate every hour, and the proposal of a panel of publishers with its median. The starting source (decided in the afternoon): the European Central Bank's daily reference rate; the app always shows the rate's date; a quote is valid for 10 minutes.
Community money always goes to projects. Project wallets and the reserve have no key. A project starts receiving once three have approved it and there is no objection; an objection to a new project stops it (since 23 October 2026 the consensus vote "all for, or it falls" instead, E-5). A project receives up to its amount; gravity and new steps flow into it. Surplus goes to the reserve; the reserve moves on to a new approved project by itself. Common Good as a single wallet and the fund key are dropped. Details decided in the afternoon:
- 8a: a project pays the doer once it has collected its whole amount.
- 8b: the inflow goes to the projects in order, the oldest first; for now with no limit on the amount and no other limits.
- 8c: an objection is possible within 72 hours of publication; the project stays stopped until the objector withdraws the objection; once the project is receiving, an objection does not stop it. Replaced on 23 October 2026 by E-5.
- 8e: a project is closed with 72 hours of public notice (since 23 October 2026 the Circle Heart closes it; the notice is a circle setting, E-1), and the money goes to the reserve; a project that does not fill within 90 days ends by itself.
- 8f: paying a project does not use up the community's money (the doer's wave grows, the same amount goes on); the brake is the approval (since 23 October 2026 the vote, E-5); the sum stays 0.
- 8i: the world account and the step-outward account have no key. The circle's main account went with the deposits (6a); a new circle does not have it.
- 8j: nobody pays for a payment into another circle that hangs. After 7 days the payer's circle looks into the receiving circle's public ledger itself. If the payment is not there (that circle's seals cover the whole time up to the note's deadline), the held amount goes back to the payer; if it is there, the payment stands; if the ledger cannot be read, the payer's circle waits. The earlier rule "a refund from the community by public decision" is dropped. Raising the step outward is a project like any other; when it is full, the step rises by that amount.
- When no project is receiving, the inflow stays in the reserve (8d; follows from decision 8).
- 6c, the first money in a new circle (later the same day, »6c, da«): At founding, the circle's reserve gets one start (»zagon«): 1,000 in the circle's currency. It is booked from a keyless account, »izvor« ("origin"), which goes into minus by the same amount, so the ledger's sum stays zero. The start is not used up but keeps coming back (8f): a project pays a doer below the wave cap, the doer's wave grows, and the same amount goes on to the next project or to the reserve. There is no other first money: no starting wave for members, no bridge from Lana. The account name »izvor« / "origin" and the exact shape of the entry are a proposal for definitions 0.3.0 (plan step C1). The live circle (one member, no payments) gets the same start when its ledger begins (proposal: 1,000 EUR).
- Still open: 8g (contributions) and 8h (the doer of a project).
Founding circles: no personal approval; the ledger is public from the first block; into the directory by a rule the relay checks (the founder is registered with Lana, at most three circles per founder); limited space on the borrowed Lana relays. In the owner's words: "I like founding circles this way for now." Proposal P3 is dropped. "At most three circles per founder" was replaced by E-8 on 23 October 2026 (only a member of an existing circle, one circle per key).

Earlier decisions that stay:

Development principles (the project owner, 16 October 2026): the six principles; "the whole ledger is kept only through the relays, truly nothing local; applications only read from the relays"; "transparent, decentralised infrastructure is the basis of our development, and nothing is ever hidden"; "the four Lana relays will not carry 100 billion transactions; the system must be scalable".
What follows from them without a new decision: every payment goes on the relays with both balances after it; no salt and no 20-account threshold; at switch-on the whole history goes to the relays; a new relay gets the whole history; settings, project decisions and membership each get their own signed public record; nothing stays on a server that cannot be rebuilt from the relays, and this is checked every morning. The name words are always in the member home (formerly proposal P9). Under decision 5 they stay, because the member home is rewritten when the name changes.
Every circle has its own app (circle in a box), never one master app for several circles (16 October 2026).
One currency per circle (16 October 2026).
Whoever creates a circle founds it (16 October 2026); since 23 October 2026 only a member of an existing circle, one circle per key (E-8).
Circles start on borrowed Lana relays (16 October 2026).
The circle key is held by the app and by the circle's creator (16 October 2026).
Root relays are only the Lana relays listed in record 38888 (14 September 2026). Since 16 October this applies to the root relays, not to circles' ledgers (decision 2). Only its relay list is read from 38888; its currency values are LANA prices, not exchange rates (15 October 2026).
The member home is mandatory; the Lana profile is mandatory and minimal: the key and the name, with the wallet address filled in by the app (16 October 2026).
One seal a day, after the morning gravity, at 04:00 in the live circle (16 October 2026; each circle writes its morning hour at founding, C7).
The BSA ID is the public key in HEX of the same private key as the LANA WIF, never npub (16 October 2026).
Private keys never go anywhere; nothing goes to the relays without the project owner's explicit yes (16 October 2026).
72 hours of public notice, a public answer to every objection before approval, and the step outward (10 October 2026, simplified 15 October 2026), in the document "Community safeguards and the step outward". It used to apply to orders; now it applies to projects. These 72 hours were also the time for objections (8c). The notice, the answer to objections and the objection were replaced on 23 October 2026 by the vote (E-5), which runs at least 72 hours by default. The refund to a payer after 7 days by public decision has been replaced by decision 8j (above): the payer's circle looks into the other circle's ledger, and nobody pays a refund.
No deduction and no threshold on exchange; history is never overwritten (16 October 2026), in the document "Currencies and exchange rates". The part of that decision under which the owner's key signs the rate every hour and the last rate stays valid has been replaced by decision 7.

The owner's answers to points C1–C7 (the project owner, 17 October 2026). In the owner's words: "1. YES - store the parameters in a separate KIND so that, if we change it world-wide, they change in every application · 2. YES · 3. YES · 4. YES · 5. I don't understand why you don't do this right away · 6. YES — Please explain point 5 before we go on to D", and after the explanation of points 5 and 1: "7 Yes, you can do it all together in phase D …":

The time values and the three who approve a project are a world rule (decided 17 October 2026, C1): the time values (72 hours for notice and objection, 72 hours before closing, 90 days, 7 days, 10 minutes) and the three who approve a project are the same for every circle. A circle cannot change them; they are not settings of the box. They live in one world-wide rules record (a kind of its own, 43920 BSA Rules), signed by the same key that publishes the definitions on lananostr.site. A change counts only from the day written in the record, at least 7 days after it is published, never retroactively. Every block and seal records the rules version. Later the record can need several keys (for example 3 of 5). The circle's own parameters (wave, gravity) stay the circle's. In the owner's words: "store the parameters in a separate KIND so that, if we change it world-wide, they change in every application" and "you can do it all together in phase D". Replaced on 23 October 2026 by E-1: the periods and limits are circle settings that the Circle Heart changes; there is no world rules record any more (KIND 43920 is retired, its number stays reserved).
Payments never wait in the morning (decided 17 October 2026, C2): visit before touch: an account's morning gravity is booked right before the first entry that touches it after the morning. The owner's answer: "YES". An act (for example a vote) does not touch an account; only an entry that moves money does (clarification, 17 Oct 2026 (D1 review)).
Refusals and how long an act is valid (decided 17 October 2026, C3): refusals of keys that are neither members nor joining are only answered, never booked. An act, the found act included, is valid 7 days. At most 20 refusals of one key a day go into the ledger. The owner's answer: "YES". Since 23 October 2026 the 7 days and the 20 refusals are default circle settings (E-1).
No special rejection (decided 17 October 2026, C4): none of those who approve a project rejects it alone; an objection stops a project. The owner's answer: "YES". Replaced on 23 October 2026 by E-5: there is no objection any more; a single "against" of any member makes a project fall; there is still no separate act of rejection.
The circle's name is its circle id; the circle key can be replaced (decided 17 October 2026, C5): the circle id is the fingerprint of the found act the founder signs; the key is not the circle's name. A stolen or lost key is replaced by three of the four (now Heart members) with 72 hours of public notice; the witnesses book the change. Since 23 October 2026 the notice is a circle setting, 72 hours by default (E-1). In the owner's words: "I don't understand why you don't do this right away" and, after the explanation, "you can do it all together in phase D".
The first-seen rule ("the first ledger stands") (decided 17 October 2026, C6): it goes into the letter to the Lana relay owner (phase G); with the circle id it is only extra safety. The owner's answer: "YES".
Time zone, morning hour and tzdata (decided 17 October 2026, C7): written at founding in the found act and not changed in 0.3.0; a later definitions version may say how a circle follows new clock-change rules. The owner's answer: "7 Yes".

The owner's answers to the three questions after phase D (the project owner, the evening of 17 October 2026). In the owner's words: "all yes" (»vsi da«) to the proposal »1A, 2A, 3A«:

Who signs the world rules (decided 17 October 2026, evening, 1A): for now the world rules record is signed only by the key that publishes the definitions, that is, the project owner's. Several signatures (for example 3 of 5) are introduced before the first circle the project owner does not run joins (for example the first circle from another ecosystem). Who the signers will be is still open. So the tension with principle 3 (no central authorities) is limited in time and said openly. Dropped on 23 October 2026 by E-1: there is no world rules record and no signer of it any more.
The tzdata version (decided 17 October 2026, evening, 2A, part of C7): at founding the found act writes down, besides the time zone and the morning hour, the version of the time-zone database (tzdata). The witnesses compute the morning hour with that version, not with their own newest one. In 0.3.0 it never changes; not even the Circle Heart can replace it. That the Heart may replace it (for example when a country drops the clock change) can only come with a later version of the definitions.
The transition period (decided 17 October 2026, evening, 3A): the 60 days of gentler gravity run for each account from its own first receipt, as definitions 0.3.0 say. Today's app counts them from the circle's start; the live circle has no payments, so today this affects nobody. At the switch to the new gravity the per-account rule applies.

The owner's answers before phase E (the project owner, 23 October 2026; the full decisions and the owner's words are in the document "Circle governance" under "Decided"):

E-1, circle settings (»72 ur ne more biti fiksno to je lahko default nastavitev, ki jo lahko spremeinijo«, "72 hours cannot be fixed; it can be a default setting that they can change"): every circle sets its own periods and limits; the values in the definitions are default settings, which the Circle Heart changes within the bounds of the definitions. There is no world rules record and no signer any more (1A is dropped). The same for every circle: a project needs at least three Heart votes for and none against; the money and gravity computation.
E-2, the Circle Heart (»Upravitelji bodo po novem Srce kroga, tako se bo njihova postavitev imenovala«, "From now on the stewards will be the Circle Heart; that is what their office will be called"): power lies with those who created the circle and tend it; the circle's members do not elect the Heart; whoever disagrees leaves and creates their own circle; the Heart adds and removes Heart members (k = 3, the proposal stays).
E-3, exclusion and old accounts: the Heart excludes any member with three votes, at once, for 3 months; then it decides on readmission; a former Heart member comes back only as a member. The excluded person's money stays frozen, the plus may go to another circle, the minus stays with the circle. The Heart can close old accounts: gravity takes a plus to 0; at closing the wave goes to 0 and the reserve returns the same amount to the origin; the circle covers a minus only if the member dies (confirmed in the addition).
E-4, OWN: the Heart leads and oversees the OWN processes; they run encrypted in the OWN apps; only the decision reaches the ledger.
E-5, the consensus vote "all for, or it falls": all members vote for or against; the proposer sets the duration at publication, the shortest 72 hours by default; a project needs at least three Heart votes for and none against. Replaces 8c.
E-6, joining: open, invite only, or a maximum number with a waiting list; the first on the waiting list comes in by itself; the Heart decides about an excluded person.
E-7, witnesses (»A niso priče računlaniki in se določajo z žrebom«, "But aren't witnesses computers, and they are chosen by lot"): witnesses are computers, chosen by lot among the circles' computers (phase I); until then one witness, the circle's own computer; the Heart's vote (3 for, nobody against) only for exceptions.
E-8, founding (»Torej vsi krogi zrastejo z enega prvega korga.«, "So all circles grow from one first circle."): only a member of an existing circle founds a circle; one circle per founder; a member of one circle at a time; one person with two keys is not prevented. Replaces "at most three circles per founder".
E-9, the reference (»Sprejema se v nov krog samo z refrenco, brez tega ni nič«, "A new circle admits only with a reference; without it there is nothing"): the reference is issued by itself when a member says "I want to leave" and has settled; nobody moves without a reference; it lists the published projects, the projects taken part in, the step built and that there is no open OWN process. Completed the same day (»1 a,«; »potem mu lahko drugi krog pošlje tej skupnosti ta denarki ga je dobil od tega člana ki ga je ustanovil nov korak.. in se zadeva izniči«, roughly "then the other circle can send this community the money it got from this member who opened the new step.. and the matter cancels out"): (a) an open OWN process blocks the reference also without a debt; (b) the new circle opens the same step and sends the same amount to the old circle's community, which closes the account and returns the amount to its »izvor«; both communities stay as they were.
E-10 and E-11 (»1B, vendar OWN proces lahko sproži vsak.. ostalo ok / 2A / 3A / 4A« and »1a,2a in 3c«): an exclusion, a readmission, an account close and the witness exceptions always need at least three Heart members; any member opens an OWN process, one Heart member closes it; the wave a reference brings counts against the new circle's step outward; the longest vote 14 days by default; the Heart may close anyone's account with a public reason. After the review of round 5: the hold of a move has no deadline (a silent old circle means waiting); on a proposal without money the proposer's own vote counts; gravity is never stronger than today's, and making it stronger needs at least 30 days of notice; a Heart member who leaves loses the Heart seat; a join with a step is not possible while an earlier move out of the circle is not settled; a reference is valid once (if the old circle refuses it, the new circle takes the step away).

Proposals and questions waiting for the owner's yes#

Still open (the project owner did not answer these):

Open 3a, seven witnesses in a large circle: proposal: a circle above about 10,000 members has seven witnesses, five must agree. Whether one owner may then hold two is for the project owner to decide. Until the project owner answers: at most one witness per owner.
Open 8g, a contribution to a project: may a member give to a project only their plus, as today, and not from their wave? Proposal: only the plus. Whatever exceeds what the project still lacks goes to the reserve. A contribution that names no project goes to the reserve and from there to the projects.
Open 8h, the doer of a project: must the doer of a project be a member of the circle? For example whoever gives the circle a relay. Proposal: yes, the doer joins the circle first.
Moving with a step, safety (for E-9 (b)) [Decided 23 Oct 2026, E-10 (2A)]: the wave the new circle opens counts against its step outward; a join whose wave no longer fits under the step waits on the waiting list. Said openly: a circle that cannot raise its step then takes in no waves from elsewhere (a founder in a new circle with step 0 waits too).
Answered on 23 October 2026 (E-10), "three" for an exclusion, a readmission, an account close and the witnesses: always at least three Heart members, the threshold is the larger of k and 3.

Proposals for the decided rules (details the owner's answers do not settle):

Changing the rate source: a circle changes its source at any time, by a public act of k Heart members (three of four in the live circle). The Heart members are alerted when the rate is older than 120 hours (over holidays a daily rate can be 4 to 5 days old).
Closing a project: k Heart members close a project (three of four in the live circle). A project's money also goes to the reserve without a decision of the Heart when the doer steps back, leaves the circle or is excluded, when the proposer withdraws the project, or when payment falls due and the doer is no longer a member.
The 90 days are counted from the day the project starts receiving.
The Heart's other acts: relays, a new node and the rate source are signed by k Heart members (three of four in the live circle). This is decided for the circle key (C5) and for the settings (E-1). Exclusion, readmission and closing accounts (E-3), the witness exceptions and recovery (E-7: for, and no Heart member against) always need at least three Heart members: the threshold is the larger of k and 3, and a Heart of fewer than three cannot do them [Decided 23 Oct 2026, E-10]. Any member opens an OWN process alone; one Heart member closes it [Decided 23 Oct 2026, E-10].
The recipient's consent as today for an order; a project that has not opened 30 days after publication expires.
The step outward: the recipient of a step-raise project is the step-outward account (since that account has no wave, such a project really uses up community money); the step is lowered by a vote like a project, never below what the circle has already used outside.
A payment that hangs: if it is still unclear after 7 days, the payer's circle looks into the other circle's ledger again once a day until it is clear.
The circle key, details (for decision C5): at a change the new key signs for itself and so proves that it is really held (proof of possession); it signs the circle id, itself and the time of the proposal, so this signature can never be used again later; the circle key is never the founder's, a witness's or a Heart member's key; the new key is not the key already in office; a block holds at most one roles entry, so one block number always means one mirror and a second roles entry in the same block can never undo the first (for example a key change); every daily seal and every circle head in the directory (a pointer to the latest seal) carries the circle key that the ledger names at the last block the seal covers (if that is the block of a key change, already the new key), so a reader of the directory finds the right circle record.
Circle settings, details (for E-1): the bounds of every setting (proposal; the table is in the document "Circle governance", under the circle's settings); the Heart changes the whole set at once (k Heart members, at most one open proposal); the notice lasts at least the notice of a change (72 hours by default) and at least as long as the period being changed was, so a stolen key cannot skip the warning; the new value applies from the first block after the notice ends and never retroactively; during the notice apps sign with the stricter value; across circles each circle applies its own values, and a mismatch ends in a refusal and a return to the payer. The open question whether the 72 hours for changing witnesses, relays, recovery and the circle key should follow the world rule is answered by E-1: all of them are one circle setting, the notice of a change (72 hours by default).
Proposals and tensions of 23 October 2026: the list of every new proposal and of the tensions with the principles is in the document "Circle governance", under "Proposals and questions". Two tensions matter for a new circle: the live circle as the root of every circle, and founding only through membership (principles 3 and 5); and admitting someone from another circle depends on reading the old circle's ledger (principle 5). The tension of 1A is removed.

The other questions stay proposals:

Question 14, relay owners: decision 2 says at least four relays with at least three owners. Proposal: while a circle is borrowed, three relays of at least two owners are enough (the box relay and the Lana relays); this is a temporary departure from decision 2, so it is for the project owner to approve; at least three owners at the latest when the circle gets four witnesses. I count the four Lana relays as one owner until the project owner says otherwise. It is open whether they really are one owner. Tension: until the Lana relay owner adds the write rules, only the box relay counts. Under decision 1 no payment could then ever count, and the circle would depend on one outside owner. Decide: (a) the circle books nothing until then; (b) until then the Lana relays count as copies with the public label "copies without protection against deletion"; (c) until then the circle finds two more relays with the same rules at other owners.
Question 17, not waiting for every relay: sending to the others goes on, the real "N of M" always visible. Changes the rule of 14 September.
P2, the circle key in the browser and on paper (stays a proposal). Under the proposal the circle key would sign only the mirror and, once, the found act in the first block. That the circle key can be replaced is decided (C5).
Question 10, record 38888: the starting directory, not a dependency. This changes the role of the owner's 38888 decision: the root relay list stays, but a circle does not depend on it.
Question 13, circle size: at most 100,000 members for now.
Question 15, who pays for the relays: the circle itself. Under decision 8 this is a project of the circle, no longer an order from Common Good.
Question 18, a new letter to the Lana relay owner (replacing the former proposal P6): write rules, no deletion of ledger records, limited space for small circles, who runs which relay. The first-seen rule ("the first ledger stands") goes into the letter too (decided 17 October 2026, C6; with the circle id only extra safety). When the Lana relays count as copies depends on this letter (the tension under question 14). Sent after the owner's yes.
Question 19, the box relay never removes anything: a fast relay may remove an old record only after three archive copies with different owners.
Question 20, the version of the definitions in the circle's ledger. There are no world rules any more (E-1); the state of the ledger carries the settings in force at every block.
Question 23, witnesses' votes: a daily summary at first, a single vote as proof.
P7, the yes for publishing: one yes per version of the definitions and one yes to switch on each kind of record.